DEF CON moves venues, the Canadian government moves to ban Flipper Zero, and some XSS issues affect Microsoft Whiteboard and Meta's Excalidraw.
Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/241.html
[00:00:00] Introduction
[00:00:33] DEF CON was canceled.
[00:16:42] Federal action on combatting auto theft
[00:39:03] Jenkins Arbitrary File Leak Vulnerability, CVE-2024-23897, Can Lead To RCE
[00:43:27] Back to the (Clip)board with Microsoft Whiteboard and Excalidraw in Meta (CVE-2023-26140)
[00:52:26] SSRF on a Headless Browser Becomes Critical!
[00:59:04] ChatGPT Account Takeover - Wildcard Web Cache Deception
[01:05:14] Differential testing and fuzzing of HTTP servers and proxies
[01:10:14] Hunting for Vulnerabilities that are ignored by most of the Bug Bounty Hunters
[01:19:38] Analyzing AI Application Threat Models
The DAY[0] Podcast episodes are streamed live on Twitch twice a week:
-- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
-- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.
We are also available on the usual podcast platforms:
-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063
-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt
-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz
-- Other audio platforms can be found at https://anchor.fm/dayzerosec
You can also join our discord: https://discord.gg/daTxTK9
A Kernel Race, SuDump, and a Chrome Garbage Collector Bug [Exploit Dev/VR]
A Slack Attack and a MySQL Scientific Notation Bug [Bug Hunting]
WebKit Bugs, a Windows Race, and House of IO Improved [Exploit Dev/VR]
WebSocket Hijacking, GitHub review bypass and SQLi to RCE [Bug Hunting]
HyperKit Bugs & an Open5GS Stack Overflow [Binary Exploitation]
SharePoint RCE & an Apache Path Traversal [Bug Hunting]
Chrome Exploits and a Firefox Update Bug [Binary Exploitation]
Gatekeeper Bypass, Opera RCE, and Prototype Pollution [Bounty Hunting]
Kernel UAFs and a Parallels VM Escape [Binary Exploitation]
iOS 0days, Apache Dubbo RCEs, and NPM bugs [Bounty Hunting]
A Curl UAF, iPhone FORCEDENTRY, and a Crazy HP OMEN Driver [Binary Exploitation]
A Flickr CSRF, GitLab, & OMIGOD, Azure again? [Bounty Hunting]
NETGEAR smart switches, SpookJS, & Parallels Desktop [Binary Exploitation]
Reused VMWare exploits & Escaping Azure Container Instances [Bounty Hunting]
Escaping the Bhyve, WhatsApp, & BrakTooth [Binary Exploitation]
Takeover A Facebook, SnapChat or JetBrains Account [Bounty Hunting]
NoSQL Injection, Mobile Misconfigurations and a Wormable Windows Bug
Cross-Browser Tracking, Frag Attacks, and Malicious Rust Macros
Fake Vulns, More Valve, and an AWS Cognito issue
Defcon Quals, Dead μops, BadAllocs, Wordpress XXE
Create your
podcast in
minutes
It is Free
Insight Story: Tech Trends Unpacked
Zero-Shot
Fast Forward by Tomorrow Unlocked: Tech past, tech future
The Unbelivable Truth - Series 1 - 26 including specials and pilot
Lex Fridman Podcast